# CVEs published 2017-08-22 26 CVEs were published on August 22, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-1422](https://cve.now/CVE-2017-1422.md): IBM MaaS360 DTM all versions up to 3.81 does not perform proper verification for user rights of certain applications which could disclose se (no CVSS, IBM MaaS360 DTM) - [CVE-2015-5258](https://cve.now/CVE-2015-5258.md): Cross-site request forgery (CSRF) vulnerability in springframework-social before 1.1.3. (no CVSS, org.springframework.social:spring-social-core) - [CVE-2015-6472](https://cve.now/CVE-2015-6472.md): WAGO IO 750-849 01.01.27 and 01.02.05, WAGO IO 750-881, and WAGO IO 758-870 have weak credential management. (no CVSS) - [CVE-2015-6473](https://cve.now/CVE-2015-6473.md): WAGO IO 750-849 01.01.27 and WAGO IO 750-881 01.02.05 do not contain privilege separation. (no CVSS) - [CVE-2016-2102](https://cve.now/CVE-2016-2102.md): HAProxy statistics in openstack-tripleo-image-elements are non-authenticated over the network. (no CVSS) - [CVE-2016-4460](https://cve.now/CVE-2016-4460.md): Apache Pony Mail 0.6c through 0.8b allows remote attackers to bypass authentication. (no CVSS) - [CVE-2016-6310](https://cve.now/CVE-2016-6310.md): oVirt Engine discloses the ENGINE\_HTTPS\_PKI\_TRUST\_STORE\_PASSWORD in /var/log/ovirt-engine/engine.log file in RHEV before 4.0. (no CVSS) - [CVE-2016-6311](https://cve.now/CVE-2016-6311.md): Get requests in JBoss Enterprise Application Platform (EAP) 7 disclose internal IP addresses to remote attackers. (no CVSS) - [CVE-2017-5208](https://cve.now/CVE-2017-5208.md): Integer overflow in the wrestool program in icoutils before 0.31.1 allows remote attackers to cause a denial of service (memory corruption) (no CVSS) - [CVE-2017-12785](https://cve.now/CVE-2017-12785.md): The novish command-line interface, included in the NoviWare software distribution through NW400.2.6 and deployed on NoviSwitch devices, is p (no CVSS) - [CVE-2017-12786](https://cve.now/CVE-2017-12786.md): Network interfaces of the cliengine and noviengine services, included in the NoviWare software distribution through NW400.2.6 and deployed o (no CVSS) - [CVE-2017-12787](https://cve.now/CVE-2017-12787.md): A network interface of the novi\_process\_manager\_daemon service, included in the NoviWare software distribution through NW400.2.6 and deploye (no CVSS) - [CVE-2014-6189](https://cve.now/CVE-2014-6189.md): Cross-site scripting (XSS) vulnerability in IBM Security Network Protection 3100, 4100, 5100, and 7100 devices with firmware 5.2 before 5.2. (no CVSS) - [CVE-2015-2857](https://cve.now/CVE-2015-2857.md): Accellion File Transfer Appliance before FTA\_9\_11\_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oaut (no CVSS) - [CVE-2015-3617](https://cve.now/CVE-2015-3617.md): Fortinet FortiManager 5.0 before 5.0.11 and 5.2 before 5.2.2 allow local users to gain privileges via crafted CLI commands. (no CVSS) - [CVE-2017-12843](https://cve.now/CVE-2017-12843.md): Cyrus IMAP before 3.0.3 allows remote authenticated users to write to arbitrary files via a crafted (1) SYNCAPPLY, (2) SYNCGET or (3) SYNCRE (no CVSS) - [CVE-2017-7557](https://cve.now/CVE-2017-7557.md): dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack. (no CVSS, Red Hat dnsdist) - [CVE-2017-13058](https://cve.now/CVE-2017-13058.md): In ImageMagick 7.0.6-6, a memory leak vulnerability was found in the function WritePCXImage in coders/pcx.c, which allows attackers to cause (no CVSS) - [CVE-2017-13059](https://cve.now/CVE-2017-13059.md): In ImageMagick 7.0.6-6, a memory leak vulnerability was found in the function WriteOneJNGImage in coders/png.c, which allows attackers to ca (no CVSS) - [CVE-2017-13060](https://cve.now/CVE-2017-13060.md): In ImageMagick 7.0.6-5, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to cause (no CVSS) - [CVE-2017-13061](https://cve.now/CVE-2017-13061.md): In ImageMagick 7.0.6-5, a length-validation vulnerability was found in the function ReadPSDLayersInternal in coders/psd.c, which allows atta (no CVSS) - [CVE-2017-13062](https://cve.now/CVE-2017-13062.md): In ImageMagick 7.0.6-6, a memory leak vulnerability was found in the function formatIPTC in coders/meta.c, which allows attackers to cause a (no CVSS) - [CVE-2017-13063](https://cve.now/CVE-2017-13063.md): GraphicsMagick 1.3.26 has a heap-based buffer overflow vulnerability in the function GetStyleTokens in coders/svg.c:314:12. (no CVSS) - [CVE-2017-13064](https://cve.now/CVE-2017-13064.md): GraphicsMagick 1.3.26 has a heap-based buffer overflow vulnerability in the function GetStyleTokens in coders/svg.c:311:12. (no CVSS) - [CVE-2017-13065](https://cve.now/CVE-2017-13065.md): GraphicsMagick 1.3.26 has a NULL pointer dereference vulnerability in the function SVGStartElement in coders/svg.c. (no CVSS) - [CVE-2017-13066](https://cve.now/CVE-2017-13066.md): GraphicsMagick 1.3.26 has a memory leak vulnerability in the function CloneImage in magick/image.c. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-08-22 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.